npm/@grackle-ai/runtime-sdk

Grackle has command/argument injection in the git worktree executor that enables RCE on provisioned hosts via an unsanitized task branch name (shell:true)

Modified: 9/10/2026